medium6.5
CVE-2022-23722
When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authenticatio…
Impact
When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pingidentity | Pingfederate | from 9.3.0 before 9.3.3 from 10.0.0 before 10.0.12 from 10.1.0 before 10.1.9 from 10.2.0 before 10.2.7 from 10.3.0 before 10.3.4 Version 9.3.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://docs.pingidentity.com/bundle/pingfederate-110/page/spk1642790928508.html
- https://www.pingidentity.com/en/resources/downloads/pingfederate.html
- https://docs.pingidentity.com/bundle/pingfederate-110/page/spk1642790928508.html
- https://www.pingidentity.com/en/resources/downloads/pingfederate.html